Integrating Therefore™ with Azure Active Directory

Integrating Therefore™ with Azure Active Directory

Azure Portal Configuration

Step 1: Configuring the Therefore Client connection.

The initial steps for making this possible take place within the Azure Portal:

  1. Navigate to https://portal.azure.com (and login if required).
  2. Select ‘Azure Active Directory’.
  3. Select ‘App Registrations’ along the left side panel.
  4. Select ‘New Registration’.
  5. Populate the ‘Name’ field with ‘Therefore Client Login’.
  6. Ensure ‘Accounts in this organisational directory only’ is selected.
  7. Select ‘Register’ to confirm registration of the application.
  8. Select ‘Authentication’ along the left side panel.
  9. Select ‘Add a platform’, then ‘Web’.
  10. Configure the Redirect URI as such:
    1. https://<tenantname>.thereforeonline.com/Client/WEB/Login/SSOLogin.aspx
  11. Tick ‘Access Tokens’ and ‘ID Tokens’ in the ‘Implicit Grant’ section.
  12. Select ‘Add a platform’, then ‘Mobile and Desktop Applications’.
  13. Tick ‘https://login.microsoftonline.com/common/oauth2/nativeclient’.
  14. Select ‘Configure’ to confirm the new platform configuration.
  15. Select ‘Manifest’ along the left side panel.
  16. Change the allowPublicClient property from null to true.
  17. Change the groupMembershipClaims property from null to “SecurityGroup”.
  18. Select ‘Overview’ along the left side panel and make a note of the Application (client) ID (note this down as <Therefore Client ClientID>).

Step 2: Configuring the Therefore Server connection.

  1. Navigate to https://portal.azure.com (and login if required).
  2. Select ‘Azure Active Directory’.
  3. Select ‘App Registrations’ along the left side panel.
  4. Select ‘New Registration’.
  5. Populate the ‘Name’ field with ‘Therefore Server Login’.
  6. Ensure ‘Accounts in this organisational directory only’ is selected.
  7. Select ‘Register’ to confirm registration of the application.
  8. Select ‘API Permissions’ along the left side panel.
  9. Select ‘Add a Permission’.
  10. Select ‘Microsoft Graph’.
  11. Select ‘Application Permissions’.
  12. Search for and tick ‘Directory.Read.All’.
  13. Select ‘Add Permissions’ to apply the change.
  14. Select ‘Grant Admin Consent for <CustomerName>’, then ‘Yes’ in the appearing pop-up.
  15. Select ‘Certificates & Secrets’ along the left side panel.
  16. Select ‘New Client Secret’, and create it with an expiry of ‘Never’.
  17. Make a note of the Client Secret (note this down as <Application Secret>).
  18. Select ‘Overview’ along the left side panel and make a note of the Application (client) ID (note this down as <Therefore Server ClientID>).

Therefore Configuration

Step 1: Connecting Therefore to Azure AD.

The remaining steps take place within Therefore:

  1. Open Therefore Solution Designer.
  2. Expand the ‘Access’ and ‘Authentication’ nodes.
  3. Double-click the ‘External User Directories’ node.
  4. Drop-down the ‘Add’ button and select ‘Azure Active Directory’.
  5. Fill in the following details and tick ‘Use a custom application’:
    1. Therefore Client ID: <Therefore Client ClientID>
    2. Logon Domain: <logondomain>
    3. Additional Domains: <any other domains as necessary>
    4. Azure Tenant Name: <azuretenant>.onmicrosoft.com
    5. Application Client ID: <Therefore Server ClientID>
    6. Application Secret: <Application Secret>
  6. Select ‘OK’ once all previous details have been configured.
  7. Login with the account which has administrative access to Azure AD.

Step 2 : Testing Access from Therefore Navigator.

  1. Open Therefore Navigator.
  2. Change the ‘Authentication Provider’ to ‘Azure Active Directory’.
  3. Select ‘Update from Server’.
  4. Select ‘OK’.

This should prompt for Office365 credentials and provide access to anyone within the Azure AD.

    • Related Articles

    • Configuring Mailbox Access for Therefore™

      Introduction As of late 2022, Microsoft deprecated basic authentication for mailboxes. This introduced a substantial change to our solutions (as mailbox monitoring is very common). Any solutions using basic authentication (just username / password) ...

    • Changing User Assignments in Therefore Workflows

      Changing assigned users in Therefore tasks This guide will provide instruction on how to change the users which workflow instances are assigned to in a Therefore workflow. There are multiple methods which are used to assign workflow tasks in ...

    • Updating a Therefore > Sage DLL in a Workflow

      Updating the custom Sage DLL Over time, you may have Sage updated to a new major version for various reasons. However once this is updated, you may come across some issues the a customer DLL task in the Therefore workflow for posting data into Sage. ...

    • Installing Therefore

      Installing the Therefore client software This guide will guide you or your IT team through the installation process for the Therefore software we provide for you. This contains step by step instructions to take you through each stage of the install ...

    • Adding Keywords In Therefore

      Adding Keywords This article will give you a brief overview on how to add new keywords into Therefore. This is a simple process intended for Therefore Administrators or users with Admin access. Access to the Therefore Solution Designer will be ...